Microsoft Kiota-TypeScript vulnerabilities

2 CVEs affecting Microsoft Kiota-TypeScript, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49336, published 2026-06-19.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-49336, published 2026-06-19. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. @microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-fetchlibrary`'s…
• CVE-2026-44503, published 2026-05-14. High severity, CVSS 7.0. EPSS: 0.9% chance of exploitation in the next 30 days. The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx…